BPFDoorMalware
- backdoor.linux.bpfdoor
- backdoor.solaris.bpfdoor.zaje
- justforfun
BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant.From MISP Galaxy
Last reported 8 days ago, by Rapid712 reports
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1036Masquerading
“Tool masquerading and capture rotation: The attacker used a renamed tcpdump executable (/data/.icscap/dsstatmond) and eight rotating packet-capture files.”
- T1059.004Unix Shell
“T1059.004 Unix Shell”
- T1133External Remote Services
“T1133 External Remote Services”
- T1205.002Socket Filters
“The “Linux Socket Filters” indicator reports that dsstatmond (PID 5012) is sniffing network traffic.”
- T1005Data from Local System
“T1005 Data from Local System”
- T1008Fallback Channels
“T1008 Fallback Channels”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research“Since the original report, Rapid7 Intelligence has analyzed hundreds more samples, found previously undocumented BPFDoor variants, and tracked changes in the operators' tradecraft.”
-
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days“In fact, the same Volcano IOC also triggers on the well-known BPFDoor because its packet sniffer leverages BPF filters.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“AVERAT: Rapid7 has spotted new BPFDoor versions in a campaign delivering the AVERAT against South Korean targets.”
-
Week in review: FortiBleed is still active, Patch Tuesday forecast“What the BPFDoor backdoor tells us about attacks on the network edge”
-
What the BPFDoor backdoor tells us about attacks on the network edge“What the BPFDoor backdoor tells us about attacks on the network edge”
-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“The malicious artifacts include a new BPFDoor variant and a BPF Rekoobe build used against South Korean targets, and a previously unreported Linux implant dubbed AVERAT that's delivered via a dropper and deployed against Taiwanese appliances.”
-
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic“In research published October 2, Rapid7 said it tracked a newly observed BPFDoor variant and a BPF Rekoobe build used against South Korean targets, along with a dropper and six builds of an implant it calls AVERAT deployed against Taiwanese appliances.”
-
SMTP is the key: BPFDoor and AVERAT hitting the network edge“SMTP is the key: BPFDoor and AVERAT hitting the network edge”
-
Korea’s Largest Telco KT Fined $38m After Femtocell Campaign“…news for KT after investigators found evidence that 38 internal servers had been infected with various strains of malware including the BPFDoor backdoor.”
-
BPFDoor Scanner“BPFDoor Scanner”
-
BPFDoor Configuration Extractor“BPFDoor Configuration Extractor”
-
A peek behind the BPFDoor“A peek behind the BPFDoor”
Indicators in its reports
named in the reports above- mx.zxopfds[.]comin 2 reports
- 1.2.3[.]4in 1 report
- 144526d30ae74798…bc297ba0c1b3in 1 report
- 3a1b174f0c19c28f…e3062e49b155in 1 report
- 591198c234416c6c…8308d9127c78in 1 report
- 76bf736b25d5c9aa…b4941ce37925in 1 report
- dc8346bf443b7b45…f90359dcae3ain 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.